Office (OLE) malware analysis — malicious · 50cbd5ea01697d12

MALICIOUS

Office (OLE)

354.0 KB Created: 1998-10-31 12:58:00 Authoring application: Microsoft Word 8.0 First seen: 2020-01-07

MD5: 5a2988be525cfbd36e71f0cd75cf92f7 SHA-1: b1edfcf65e4e199c381327cba42ff9348b175315 SHA-256: 50cbd5ea01697d12fcbf3f80cdfb5d2c836bf25739b80578a24a8d231e337588

422 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample contains an embedded PE executable and triggers heuristics related to OLE exploitation and the dropping of auto-executable payloads. The presence of WinExec, CreateProcess, ShellExecute, LoadLibrary, and GetProcAddress API references further indicates the execution of malicious code. The embedded executable, 'embedded_office_00008c4d.exe', is the primary payload.

Heuristics 11

OLE with Ole10Native — possible CVE-2026-21514 exploitation high CVE likely CVE_2026_21514

Document contains a Word OLE object with Ole10Native plus executable, PE, or risky remote-link indicators. CVE-2026-21514 exploits OLE metadata validation; this stronger structure is treated as likely exploitation.
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable
Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE

OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.

Heap-spray pattern detected high SC_HEAP_SPRAY

Repeated 0x04 bytes found

Disassembly

Attempted x86 opcode disassembly

0000BE1B  0404              add al, 4
0000BE1D  0404              add al, 4
0000BE1F  0404              add al, 4
0000BE21  0404              add al, 4
0000BE23  0404              add al, 4
0000BE25  0404              add al, 4
0000BE27  0404              add al, 4
0000BE29  0404              add al, 4
0000BE2B  0404              add al, 4
0000BE2D  0404              add al, 4
0000BE2F  0404              add al, 4
0000BE31  0404              add al, 4
0000BE33  0404              add al, 4
0000BE35  0404              add al, 4
0000BE37  0404              add al, 4
0000BE39  0404              add al, 4
0000BE3B  0404              add al, 4
0000BE3D  0404              add al, 4
0000BE3F  0404              add al, 4
0000BE41  0404              add al, 4
0000BE43  0404              add al, 4
0000BE45  0404              add al, 4
0000BE47  0404              add al, 4
0000BE49  0404              add al, 4
0000BE4B  0404              add al, 4
0000BE4D  0404              add al, 4
0000BE4F  0404              add al, 4
0000BE51  0404              add al, 4
0000BE53  0404              add al, 4
0000BE55  0404              add al, 4
0000BE57  0404              add al, 4
0000BE59  0404              add al, 4
0000BE5B  0404              add al, 4
0000BE5D  0404              add al, 4
0000BE5F  0404              add al, 4
0000BE61  0404              add al, 4
0000BE63  0404              add al, 4
0000BE65  0404              add al, 4
0000BE67  0404              add al, 4
0000BE69  0404              add al, 4
0000BE6B  0404              add al, 4
0000BE6D  0404              add al, 4
0000BE6F  0404              add al, 4
0000BE71  0404              add al, 4
0000BE73  0404              add al, 4
0000BE75  0404              add al, 4
0000BE77  0404              add al, 4
0000BE79  0404              add al, 4

Reference to WinExec API high SC_STR_WINEXEC

Reference to WinExec API
Reference to CreateProcess API high SC_STR_CREATEPROCESS

Reference to CreateProcess API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.kubiss.de In document text (OLE body)
- http://www.kubiss.de/In document text (OLE body)
- http://www.kubiss.de/kubiss/kontakt/anmeldung.htmIn document text (OLE body)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`embedded_office_00008c4d.exe`	embedded-pe	Office MZ+PE at offset 0x8C4D	326579 bytes
SHA-256: `2c9cd1b4b855fcfd98c5afdbe65b4c97419c1e5f5c5057320a6ecff38ca53c26`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x04, SC_STR_SHELLEXEC, SC_STR_CREATEPROCESS Static shellcode analysis recovered API/import strings: CreateProcessA, CreateFileA, GetProcAddress, LoadLibraryA
`ole10native_00.bin`	ole-package	OLE Ole10Native stream: ObjectPool/_971877660/Ole10Native	277644 bytes
SHA-256: `e8f082ccad2a9081d8b306151e93e3bd3ffdc1f43ac218ab9b2a4468dbb24a1d`
Detection ClamAV: No threats found Obfuscation or payload: likely Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x04, SC_STR_SHELLEXEC, SC_STR_CREATEPROCESS Static shellcode analysis recovered API/import strings: CreateProcessA, CreateFileA, GetProcAddress, LoadLibraryA

Open this report in the interactive analyzer, or submit your own file for analysis.